FP98: Browsing to ASP Files Through Shtml.dll Displays ASP Code

Under certain conditions, an intruder knowledgeable in the architecture of the FrontPage Server Extensions may use his knowledge to gain access to the source code for Active Server Page files on an unprotected Web server. This is a security issue for those that have sensitive information in their ASP or Active Server Application (ASA) files.

To resolve this issue, you must install the updated version of the FrontPage Server Extensions. For more information about how to obtain and install the FrontPage Server Extensions, visit the following Microsoft Web site:

Microsoft has confirmed this to be a problem in the Microsoft products listed at the beginning of this article. This problem was corrected in version 3.0.2.1330 of the FrontPage Server Extensions.

The FrontPage Server Extensions, version 3.0.2.1330, looks for either of the following in a page before processing it: If this value is found, Shtml.dll will not process any text until it comes across a %> value. If this value is found, Shtml.dll will not process any text until it comes across a </script> value.

Alternatively, you can specify what file extensions Shtml.dll will evaluate. To do this, add the following line in the Frontpg.ini file where .ext1 and .ext2 are the extensions you want Shtml.dll to evaluate. For example, if you want to process run-time FrontPage components on .htm and .html pages only, add the following line to the Frontpg.ini: